A hard-coded token type in Cleo Harmony has been found to let an ordinary user’s session be read as an administrator’s, because the token was looked up in a different user database from the one that issued it. Armadin published the research on Sept. 2, 2026.
The two flaws behind it, CVE-2026-84114 and CVE-2026-84115, were fixed in Harmony 5.8.1.11, which Cleo’s release notes date to May 15, 2026. That patch and the two since are restricted releases, and Cleo has published no security bulletin.
The records rate CVE-2026-84114 at 6.3 and CVE-2026-84115 at 8.3 under CVSS 3.1. VulDB, which assigned both identifiers, said the exploit for CVE-2026-84115 has been made public.
The Token Was Issued in One Store and Read in Another
Armadin found that Cleo’s token issuer hard-coded a privileged access type onto every refresh token minted for a local user, regardless of that user’s own privileges. That token was genuinely signed. The problem lay in how it was later consumed.
Consumption dispatched on the token’s type. A privileged type sent the token’s subject to be looked up in the VLNavigator administrator store, with password verification switched off.
The two stores shared an identifier namespace by accident, so most lookups simply missed. That is why the flaw stayed quiet in normal operation: it fired only when a subject collided with a real administrator name.
Armadin controlled the subject end to end. A signature wrapping flaw in Cleo’s Security Assertion Markup Language (SAML) handling, covered by the first identifier, let it assert an arbitrary identity, which the forced token issuance then carried into the token. Asserting the default administrator name returned that account pre-authenticated.
Administrator Access Was Command Execution by Design
The final step required no vulnerability. Cleo’s Actions automation engine includes a documented SYSTEM verb that runs operating-system commands as the account the Cleo service runs under, and it is on by default.
On the Windows host Armadin tested, that service account also had network access into the internal Active Directory domain. An administrative session on an internet-facing managed file transfer server therefore became a foothold inside the corporate network.
Armadin’s hunting guidance covers authentication refresh calls carrying a bearer token but no browser session cookie, and privileged tokens whose subject matches a built-in administrator alias shortly after a portal login. It also flags Commands actions containing a SYSTEM verb.
Its defensive recommendations include upgrading and disabling Harmony’s built-in default administrative account, after confirming a non-default administrator exists. The collision path needs a guessable default admin name to work.
Cleo’s notes list 5.8.1.13, dated July 22, 2026, as the current release. They also record that 5.8.1.11 introduced a startup fault corrected in the following patch.
Those notes also commit Cleo to publishing a security bulletin where a known exploit exists. The company did not immediately respond to a request for comment on whether it will do so.
